Linux kernel (drivers/nvme/target): Every command a client sends to the target carrying metadata (protection

CVSS 7.5CVE-2025-38405Kernel, userspace & hypervisorcurated

Impact

Every command a client sends to the target carrying metadata (protection information) leaks the bio integrity payload permanently. A tenant or peer issuing metadata-bearing I/O in a loop grows kernel slab without bound until the shared storage node runs out of memory.

Who can reach it

Driven entirely by a connected NVMe-oF client's command stream against an exported namespace - the leak is on the normal inline-bio path, not an error path, so no crafted failure is needed. Any peer allowed to connect to the subsystem can drive it. Conditional on the exported namespace supporting metadata/PI, which is the case for formatted-with-PI backing devices.

What to do

Update to 6.11 or later (or a stable branch carrying the linked commits). Interim: export namespaces without protection information where the workload permits, and alert on unexplained kmalloc-128 slab growth on target nodes.

References

https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508 https://nvd.nist.gov/vuln/detail/CVE-2025-38405

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.